xmrig | MicrosoftHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MicrosoftHost.exe
Size 5.2MB
Sample221031-ymj71sdcgr
SHA256 463ce847b6f7b32d1f4f49dfaaa2ce4a1061b6dfca1fb6a1bf39f7f40117266d
MD5 1ee4321c311d7e58208c61630fa3f278
SHA1 67ef36cf785ec0d4602eb35a98c23420beba2e2a
SHA512 f0bbf219926d7316bce936e4c362f2b5195420b7ee14538dd61d8a362921351cdde80705fcff8249773284a10067149f5a60291fa965aaaaca65fc535a5a8ffd
SSDEEP 98304:6ZlzjjErvvBIvXFYUxGgrrHWbQuaX6s1dICNSCcKxzLOpB:mjjAbQDX6nCNSjCKp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

File Explorer

MicrosoftHost.exe

.exe 5.2MB

MicrosoftHost.exe

IMPHASH 4cc2155e181938bc0cdc4b373d57ea09
SHA256 463ce847b6f7b32d1f4f49dfaaa2ce4a1061b6dfca1fb6a1bf39f7f40117266d
MD5 1ee4321c311d7e58208c61630fa3f278
SHA1 67ef36cf785ec0d4602eb35a98c23420beba2e2a
SHA512 f0bbf219926d7316bce936e4c362f2b5195420b7ee14538dd61d8a362921351cdde80705fcff8249773284a10067149f5a60291fa965aaaaca65fc535a5a8ffd
SSDEEP 98304:6ZlzjjErvvBIvXFYUxGgrrHWbQuaX6s1dICNSCcKxzLOpB:mjjAbQDX6nCNSjCKp
MD5 SHA1 SHA512 SSDEEP

windows x64

XMRig Miner payload

miner

Minor OS version

Major OS version

Entry point

3420724

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

recv ntohs htons send WSASetLastError WSAGetLastError select WSARecvFrom WSASocketW WSASend WSARecv WSAIoctl gethostname WSADuplicateSocketW shutdown getpeername FreeAddrInfoW GetAddrInfoW htonl socket setsockopt listen closesocket bind WSACleanup WSAStartup getsockopt getsockname ioctlsocket

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateContext CertFindCertificateInStore

kernel32

SetConsoleMode GetConsoleMode QueryPerformanceFrequency QueryPerformanceCounter SizeofResource LockResource LoadResource FindResourceW ExpandEnvironmentStringsA GetConsoleWindow GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetSystemPowerStatus GetCurrentThread GetProcAddress GetModuleHandleW GetTickCount CloseHandle FreeConsole VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache GetCurrentThreadId AddVectoredExceptionHandler DeviceIoControl GetModuleFileNameW CreateFileW SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetFileType WriteFile ConvertFiberToThread ConvertThreadToFiber GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary LoadLibraryA LoadLibraryW GetEnvironmentVariableW ReadConsoleA ReadConsoleW PostQueuedCompletionStatus CreateFileA DuplicateHandle SetEvent ResetEvent WaitForSingleObject CreateEventA Sleep QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CreateDirectoryW FlushFileBuffers GetDiskFreeSpaceW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW SetUnhandledExceptionFilter RemoveDirectoryW SetConsoleTitleA SetFileTime GetSystemInfo MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitializeCriticalSection SetConsoleCtrlHandler GetCurrentDirectoryW GetLongPathNameW GetShortPathNameW CreateIoCompletionPort ReadDirectoryChangesW VerSetConditionMask GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetTempPathW GlobalMemoryStatusEx VerifyVersionInfoA FileTimeToSystemTime RtlUnwind SetHandleInformation CancelIoEx CancelIo SwitchToThread SetFileCompletionNotificationModes LoadLibraryExW FormatMessageA SetErrorMode GetQueuedCompletionStatus InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore ResumeThread GetNativeSystemInfo CreateSemaphoreA ConnectNamedPipe PeekNamedPipe CreateNamedPipeW CancelSynchronousIo TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW DebugBreak GetModuleHandleA LoadLibraryExA GetStartupInfoW GetModuleFileNameA GetVersionExA GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask GetComputerNameA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW GetStringTypeW GetStdHandle WriteConsoleW SetFilePointerEx UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetStdHandle GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitProcess GetFileAttributesExW SetFileAttributesW GetConsoleCP CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation HeapSize SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP ReadFile K32GetProcessMemoryInfo InitializeCriticalSectionEx WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

GetProcessWindowStation GetUserObjectInformationW ShowWindow GetLastInputInfo DispatchMessageA GetMessageA GetSystemMetrics MapVirtualKeyW TranslateMessage MessageBoxW

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

advapi32

SystemFunction036 GetUserNameW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

62KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ